US Market Entry · Australia · AUKUS Pillar 2 Defense & Aerospace Manufacturers
AUKUS cleared most of the trade. The excluded work is where you onshore.
The AUKUS ITAR exemption moved roughly 70% of trilateral defense trade license-free, and it did not erase the barrier. An Excluded Technologies List still gates the most sensitive work, the relief runs only between vetted Authorized Users, and none of it waives CMMC or FOCI. For the work that still needs a US shop floor, I stand up and run the compliant operation, to a CMMC and ITAR-ready posture, in the New England corridor where the primes already are.
The direct answer
How an Australian manufacturer enters the US defense market.
An Australian defense or aerospace manufacturer enters the US defense market by standing up a compliant US operation: a US entity, a US-person data boundary, and a floor that runs to a CMMC Level 2 and ITAR-ready posture from the first day it opens. The AUKUS ITAR exemption under section 126.7, finalized on December 30, 2025, moves roughly 70% of trilateral defense trade license-free, but it runs only between vetted Authorized Users, the Excluded Technologies List still gates the most sensitive work, and qualifying-country status is a procurement preference, not an ITAR or CMMC waiver. When a program needs the operation itself to be American, the US-person data boundary is the build.
Australia sits in the AUKUS lane with the UK and the US, and that lane moved for real. The exemption makes roughly 70% of trilateral defense trade license-free, effective December 2025. What it does is move articles and technical data between Authorized Users. What it does not do is give an Australian parent a US shop floor, the US-person data boundary a prime's CUI flowdown demands, or the domestic-content standing many programs require. When the program needs the operation itself to be American, onshoring is the answer the exemption cannot be.
The exemption also carries an Excluded Technologies List, and the December 2025 final rule declined to broaden it. The most valuable Pillar 2 domains are the ones most likely to sit on that list and still require a license or domestic handling, which means the manufacturers with the highest-value US opportunity are often the ones the exemption helps least. Reading which of your technical data the exemption now covers, and which still needs a US operation, is the analysis that decides the build. That read is where the work starts.
New England is the landing zone. The prime relationships, the supply base, and the compliance depth are already here. And the pattern is proven at both ends of the market: Austal builds US Navy ships in Mobile, Alabama under a Special Security Arrangement despite its Australian ownership, and DroneShield runs its counter-drone and electronic-warfare work out of Warrenton, Virginia. A foreign-owned US defense operation is a funded reality. An Australian parent onshoring into the corridor gets an operator on the ground who builds and runs it.
Know your work class
Most Australian sub-tier work lands in one class.
Before anyone quotes an Australian parent a timeline, you need to know which class of defense work you are chasing, because each one is a different build. Commercial and dual-use parts need only a US entity and a clean quality system. Classified work needs a facility clearance and FOCI mitigation, the Special Security Arrangement structure Austal runs under, negotiated with DCSA and owned by your cleared-facility counsel.
The bulk of sub-tier DoD manufacturing sits between them: controlled technical data, CUI, ITAR-controlled but unclassified. The AUKUS exemption moves some of this data between Authorized Users and leaves the rest under the standard regime, so the class you are in decides the build. That class needs DDTC registration, a US-person data boundary, and CMMC Level 2 built into the workflow, and a foreign-owned US entity can reach it without a facility clearance.
● The class I build and run
That middle class, CUI and ITAR-controlled but unclassified, is the class I build and run. It is where an Australian supplier's US operation lives, Authorized-User status or not.
The 90-day operating build
A compliant US floor in one quarter, built where the exemption stops.
The build runs in parallel, not in sequence, because the gate you are racing will not wait for you to finish one phase before the next begins. The operating model, the IT and OT environment, and the compliance posture come up together.
Days 1 to 30
Diagnostic and design
Stand up the US operating model on paper and on the floor, and map, with your export-control counsel, which of your technical data the AUKUS exemption now moves between Authorized Users and which still needs a US-person boundary. The org, the value stream, the SQDIP cadence, and the data border come up together.
Days 30 to 60
Stabilize and build
Bring the IT and OT environment to a CMMC and ITAR-ready posture from day one, not retrofitted later. Scope the CUI enclave tight around the data that stays controlled, including anything on the Excluded Technologies List, so the assessment stays sane and the parent's access to controlled data is governed by design.
Days 60 to 90
Qualify and run
Sequence the readiness evidence against the prime gate you are actually racing, coordinate the FOCI, Special Security Arrangement, and DDTC steps with your counsel, and hand your team a floor that holds after I step back.
The Australia lane, answered
Three questions an AUKUS Pillar 2 supplier asks first.
If the AUKUS ITAR exemption lowers the barriers, why do I still need a US operation?
Because the exemption moves articles and data between Authorized Users. It does not give you a US shop floor, a US-person data boundary for a prime's CUI flowdown, or the domestic-content standing many programs require. The exemption makes about 70% of trilateral defense trade license-free, but the Excluded Technologies List still gates the most sensitive work, the relief runs only between vetted Authorized Users, and none of it waives CMMC or FOCI. When a program needs the operation itself to be American, near the prime and holding controlled data domestically, you stand one up. That build is the work I do.
Is Australia's qualifying-country status the same as an ITAR exemption?
No. They are two different regimes. Australia is a DFARS qualifying country under a reciprocal defense-procurement MOU, which gives your end products a procurement preference against Buy American restrictions. The AUKUS ITAR exemption is separate export-licensing relief among Authorized Users. Neither is a CMMC exemption, and neither clears FOCI. A foreign-owned US operation still builds the full US-person data boundary and the CMMC Level 2 posture, and that build is the work.
Austal builds US Navy ships as an Australian company. Doesn't that prove foreign ownership is fine?
It proves the path exists, and it shows what the path requires. Austal USA works on sensitive US programs under a Special Security Arrangement negotiated with DCSA to mitigate its foreign ownership, and it runs a full US operation in Alabama to do it. Foreign ownership is workable because the FOCI structure and the compliant operation are built. Your counsel owns the Special Security Arrangement. I own standing up and running the operation that sits inside it, to a CMMC and ITAR-ready posture.
What I own
The operations partner, not the law firm.
I stand up and run the compliant US operation: the floor, the operating model, the IT and OT build, the US-person data boundary, and the readiness evidence for the gate you are racing. Entity formation, FOCI mitigation, and site selection stay with your corporate counsel, your export-control counsel, and a site-selection advisor. I coordinate with them and own the operating outcome.